[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6osLo8hTF5FWhK8wne2BfZv5klAwyztqVyYFPUfUryw":3,"g5a-risk:CVE-2020-12887":130},{"success":4,"data":5,"meta":128},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":39,"epssPercentile":26,"epssTimeSeries":40,"severity":41,"affectedProducts":42,"affectedProductsCount":52,"references":53,"referencesCount":69,"weaknesses":70,"weaknessesCount":52,"isActivelyExploited":86,"cisaInfo":26,"otxData":26,"relatedBlogPosts":87,"seoMetadata":88,"configurations":113,"relatedVendorCves":126,"notableEvents":127},"CVE-2020-12887","What is CVE-2020-12887?","Memory leaks were discovered in the CoAP library in Arm Mbed OS 5.15.3 when using the Arm mbed-coap library 5.1.5. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses the CoAP option number field of all options present in the input packet. Each option number is calculated as a sum of the previous option number and a delta of the current option. The delta and the previous option number are expressed as unsigned 16-bit integers. Due to lack of overflow detection, it is possible to craft a packet that wraps the option number around and results in the same option number being processed again in a single packet. Certain options allocate memory by calling a memory allocation function. In the cases of COAP_OPTION_URI_QUERY, COAP_OPTION_URI_PATH, COAP_OPTION_LOCATION_QUERY, and COAP_OPTION_ETAG, there is no check on whether memory has already been allocated, which in conjunction with the option number integer overflow may lead to multiple assignments of allocated memory to a single pointer. This has been demonstrated to lead to memory leak by buffer orphaning. As a result, the memory is never freed.","Memory leaks were discovered in the CoAP library in Arm Mbed OS 5.15.3 when using the Arm mbed-coap library 5.1.5. The CoAP parser is responsible for parsing...","2020-06-18T19:15:11.783","2021-07-21T11:39:23.747",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":26,"CVSSMetricV2":29,"CVSSMetricV40":26},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":25,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH",null,3.9,3.6,[30],{"Source":17,"Type":18,"CVSSData":31,"BaseSeverity":36,"ExploitabilityScore":37,"ImpactScore":38,"ACInsufInfo":26,"ObtainAllPrivilege":26,"ObtainUserPrivilege":26,"ObtainOtherPrivilege":26,"UserInteractionRequired":26},{"Version":32,"VectorString":33,"AccessVector":21,"AccessComplexity":22,"Authentication":23,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":34,"BaseScore":35,"BaseSeverity":26,"Exploitability":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"CollateralDamagePotential":26,"TargetDistribution":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"EnvironmentalScore":26},"2.0","AV:N\u002FAC:L\u002FAu:N\u002FC:N\u002FI:N\u002FA:P","PARTIAL",5,"MEDIUM",10,2.9,0.01733,[39,39,39,39,39,39,39],"High",[43,48],{"vendor":44,"product":45,"version":46,"criteria":47,"vulnerable":4},"arm","mbed-coap","5.1.5","cpe:2.3:a:arm:mbed-coap:5.1.5:*:*:*:*:*:*:*",{"vendor":44,"product":49,"version":50,"criteria":51,"vulnerable":4},"mbed_os","5.15.3","cpe:2.3:o:arm:mbed_os:5.15.3:*:*:*:*:*:*:*",2,[54,59,62,65],{"url":55,"source":56,"tags":57},"https:\u002F\u002Fgithub.com\u002FARMmbed\u002Fmbed-coap\u002Fpull\u002F116","GitHub",[58],"Third Party Advisory",{"url":60,"source":56,"tags":61},"https:\u002F\u002Fgithub.com\u002FARMmbed\u002Fmbed-os\u002Fissues\u002F12930",[58],{"url":63,"source":56,"tags":64},"https:\u002F\u002Fgithub.com\u002FARMmbed\u002Fmbed-os\u002Fissues\u002F12957",[58],{"url":66,"source":56,"tags":67},"https:\u002F\u002Fgithub.com\u002Fmjurczak\u002Fmbed-coap\u002Fcommit\u002F4647a68e364401e81dbd370728127d844f221d93",[68,58],"Patch",4,[71,79],{"id":72,"name":73,"description":74,"extendedDescription":75,"status":76,"abstraction":77,"structure":78},"CWE-401","Missing Release of Memory after Effective Lifetime","The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.","This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.","Draft","Variant","Simple",{"id":80,"name":81,"description":82,"extendedDescription":83,"status":84,"abstraction":85,"structure":78},"CWE-190","Integer Overflow or Wraparound","The product performs a calculation that can\n         produce an integer overflow or wraparound when the logic\n         assumes that the resulting value will always be larger than\n         the original value. This occurs when an integer value is\n         incremented to a value that is too large to store in the\n         associated representation. When this occurs, the value may\n         become a very small or negative number.","","Stable","Base",false,[],{"title":89,"metaDescription":90,"keywords":91,"canonicalUrl":92,"structuredData":93},"What is CVE-2020-12887? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2020-12887, a high severity cyber security vulnerability from 2020. Memory leaks were discovered in the CoAP library in Arm Mbe...","CVE-2020-12887, CVE-2020-12887 vulnerability, CVE-2020-12887 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2020, CVSS score, exploit, patch, remediation, arm security, mbed-coap vulnerability, mbed_os vulnerability","\u002Fwhat-is\u002Fcve-2020-12887",{"@context":94,"@type":95,"headline":89,"description":90,"datePublished":10,"dateModified":11,"author":96,"publisher":100,"about":104,"mainEntityOfPage":108,"articleSection":111,"keywords":112},"https:\u002F\u002Fschema.org","TechArticle",{"@type":97,"name":98,"url":99},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":97,"name":98,"url":99,"logo":101},{"@type":102,"url":103},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":105,"name":6,"description":106,"additionalType":107},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":109,"@id":110},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2020-12887","Cybersecurity","CVE-2020-12887, CVE-2020-12887 vulnerability, CVE-2020-12887 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[114],{"Operator":115,"Negate":26,"Nodes":116},"AND",[117,122],{"Operator":118,"Negate":26,"CPEMatch":119},"OR",[120],{"Vulnerable":4,"Criteria":47,"MatchCriteriaID":121,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"514FAB1A-AD34-4295-BD7B-E417F85F16FD",{"Operator":118,"Negate":26,"CPEMatch":123},[124],{"Vulnerable":26,"Criteria":51,"MatchCriteriaID":125,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"B314FCEF-12B7-4510-AC5E-12D3574E3E68",[],[],{"lastModified":11,"cacheTime":129,"version":32},1792269101829,{"score":131,"band":132,"action":133,"scoredAt":134},47,"Medium","Plan remediation","2026-10-16T06:48:51.931666+00:00"]